Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Intelligence View
⚡ tsecurity.de Intelligence

Wordpress REST API - URL parameters

When working with the Wordpress REST API we can create our own endpoints and configure them according to our needs; one important feature of any API are URL parameters because they enable HTTP requests to include additional information.…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

When working with the Wordpress REST API we can create our own endpoints and configure them according to our needs; one important feature of any API are URL parameters because they enable HTTP requests to include additional information. Let's analyze how to add those parameters to a given API endpoint.






The rest_api_init action hook



Each time we want to add custom endpoint we have to implement the rest_api_init action hook as shown below:





function rch_handle_params_request(){

//call to register_rest_route() will be here...

}


add_action("rest_api_init","rch_handle_params_request");









The register_rest_route function



This function is required to configure an endpoint from scratch and as you can see it uses several parameters:




 register_rest_route(
"customAPI/v1",
"/post/(?P<id>\d+)",
array(
"methods" => "GET",
"callback" => "rch_get_custom_post"
)
);







The parameters are explained next:




  • customAPI/v1 is the namespace or a way to group endpoints; it's like a prefix and must be unique throughout the API.

  • /post/(?P\d+) is the URL parameter configuration; note how a regular expression is used to check the format of the id number.

  • The HTTP method is set to GET which enables the route to have support for GET requests only.

  • The callback parameter is set to a reference to the function which handles the HTTP request and generates the reponse.






Breaking down the callback function



The next code snippet must be placed outside the rch_handle_params_request function declaration:




function rch_get_custom_post($request){


$posts = get_posts(array(
"numberposts" => -1,
"post_type" => "post",
"post_status" => "publish",
"p" => $request['id']
));

if(!$posts){

return rest_ensure_response(new WP_Error(
"rest_not_found",
"The post does not exist",
array(
"status" => 404
)
));

}else{

return rest_ensure_response($posts);

}
}








I'm gonna try to sum up all the previous code so that you can understand it faster.



The get_posts function retrieves publications from Wordpress; two parameters are not very obvious; the first one is numberposts => -1 which indicates that all the posts matching the criteria must be retrieved and "p" => $request['id'] indicates that the id number of the matching publication must be equal to the property id of the request object; this property contains the value passed in via the URL parameter.



The if-block checks whether the $posts array is empty or not; when the $posts array is empty then an error object is retured otherwise the matching publication is returned.

1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Vulnerability Remediation & Verification
Syntax validiert (0 Fehler)
title: Detect Exploitation - Wordpress REST API - URL parameters
id: db63ae17-f3a5-4ad6-9f08-1d5717fc3aab
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-26
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
Syntax validiert (0 Fehler)
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-26"
        description = "YARA Signature for "
    strings:
        $str = "Wordpress REST API - URL param" ascii wide
    condition:
        any of them
}
Syntax validiert (0 Fehler)
index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("Wordpress REST API - URL parameters")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
Syntax validiert (0 Fehler)
message: "*Wordpress REST API - URL parameters*"
Syntax validiert (0 Fehler)
CommonSecurityLog
| where Message has "Wordpress REST API - URL parameters"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

2. Cyber Threat Intelligence & Forensik

CTI Threat Relationship Graph2 Knoten / 1 Relationen
CVE / Incident Software MITRE ATT&CK CWE Weakness IoC
🎯
MITRE ATT&CK Matrix Navigator 14 Taktiken
Reconnaissance
-
Resource Development
-
Initial Access
Execution
Persistence
-
Privilege Escalation
Defense Evasion
Credential Access
-
Discovery
-
Lateral Movement
-
Collection
-
Command and Control
Exfiltration
-
Impact
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich Wordpress REST API - URL parameters.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten Wordpress REST API - URL parameters

Thematisch verwandte Begriffe: Wordpress, REST, parameters · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-100536 | OpenClaw versions before 2026.8.1 fail to validate all source fields in…
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag